I believe this is a common issue when doing WMI remotely. If I'm not mistaken, the solution is to poll less servers. If you had two splunk instances polling, you could have each connecting to just to 20 servers and that may work fine. At least under normal load conditions. Setting up forwarders on all 40 servers I think is the most robust solution. That way you can collect all the data locally, and windows event logs can be loaded using the WinEventLog interface instead of WMI, which is better. Related question: http://answers.splunk.com/questions/3866/large-wmi-environment-questions ... View more

You can use <row grouping="3,3,3"> to get a three by three grid of singles. You can convert your ten single value searches into a table search somehow. For example, suppose that you have ten searches like: A=1 B=2 | stats count C | stats count D E=4 | stats count ... Create an event type for each of the searches, each prefixed with X_, and create a table search as follows: eventtype=X_* | stats count by eventtype Or you could append the results together: A=1 B=2 | stats count AS Value | eval Name="First Count" | append [search C | stats count | eval Name="Second Count"] | append [search D E=4 | stats count | eval Name="Third Count"] | fields Name, Value ... View more

Based on the error, its possible that updating the hostname in your alert_actions.conf file will resolve this. The mail is rejected due to "Partial domain not allowed: 'Jordan-PC'". What if you update your hostname to a fully qualified domain name? ... View more

Anthony and Genti, TKS a lot! ... View more